AI governance for financial institutions in Denmark

Two sets of expectations shape how a Danish bank, insurer, pension company or payment institution should govern AI. The first is supervisory and already in use. Finanstilsynet, the Danish Financial Supervisory Authority, published its good practice paper on using artificial intelligence in May 2024. The second is binding law with a fixed date. The EU AI Act treats some of the sector’s most common AI uses as high-risk, with obligations from 2 December 2027. This guide sets out what each asks and how to build one programme that serves both.

What Finanstilsynet expects

The DFSA’s recommendations build on its 2019 paper on supervised machine learning and are addressed to every regulated provider of financial services. They fall under three headings.

Governance. Firms should have a system that gives them an overview of their AI use, which the paper suggests can sit in the model register every firm should already keep. They should have an established approach to risk analysis and classification for both internal and bought-in models, check whether existing policies cover AI or need updating, and place responsibility for significant models with named people or units who did not build them.

Model management. Firms should consider how their AI models differ from their classical ones, plan retraining and regular validation, including for third-party models, make sure validation is independent of development for significant models, have a version control policy that lets earlier models be recreated, and manage data storage and access with care.

Explainability. Firms should document how they weigh explainability against performance for each significant model, involve the right mix of domain, technical, legal, compliance and risk skills in that judgement, understand the bias a model can produce, and justify the choice of a complex model that is hard to explain. Where a decision directly affects a consumer, such as an insurance claim or a loan application, Finanstilsynet expects the customer to be told how the conclusion was reached in more than technical terms.

The paper says it is not regulation. It also says that for firms under the executive orders on management and control of banks and of insurance companies, some of its good practice amounts to real requirements. In practice, a supervisor that has published what it considers good practice will use it as a yardstick.

What the EU AI Act adds

The EU AI Act applies directly in Denmark. Two Annex III categories reach the core of financial services. One is AI used to evaluate the creditworthiness of individuals or establish their credit score, with an exception for detecting financial fraud. The other is AI used for risk assessment and pricing of individuals in life and health insurance. Under the AI Act as amended by the Digital Omnibus, obligations for these systems apply from 2 December 2027.

A firm that deploys a high-risk system must use it according to the provider’s instructions, assign human oversight to competent people, monitor its operation, keep the logs it controls and, for these two credit and insurance uses, carry out a fundamental rights impact assessment before first use. The deployer obligations guide covers these in detail. A firm that builds its own credit scoring model is a provider and carries the heavier duties of risk management, data governance, technical documentation and conformity assessment.

Article 74(6) makes the financial supervisor the market surveillance authority for high-risk systems used by financial institutions in direct connection with their financial services. Denmark’s current law, Act No. 467 of 2025, only covers supervision of the prohibited practices. A bill that would have allocated supervision of high-risk systems lapsed with the general election in March 2026, and the Agency for Digital Government says the allocation is not yet settled.

Where the two overlap

The overlap is large, which is good news for anyone building the programme now. The DFSA’s overview of AI use is the inventory every AI Act classification starts from. Its risk tiering is where a firm decides which models fall into Annex III. Its independent validation and retraining plans line up with the AI Act’s accuracy, robustness and post-market monitoring duties. Its version control policy supports the AI Act’s documentation and logging requirements. Its explainability documentation feeds both the information a deployer must give affected people and the GDPR’s rules on solely automated decisions, which apply to any automated credit or claims decision today.

Building one programme

1. Start with the overview. List every AI model and AI-enabled product in use, including AI inside vendor software and general-purpose tools used by staff. Record purpose, owner, data used and whether it affects customers. The guide to building an AI system register sets out the fields that matter.
2. Classify once, against both. Give each model a risk tier under your own methodology, and record alongside it whether it falls into an AI Act category. Do this for bought-in models too.
3. Separate ownership from development. Name an accountable owner for each significant model who is independent of its developers, and make validation a separate task with its own resources.
4. Plan retraining and monitoring. Set out how and how often each model is retrained, and what signals trigger it, from drift in input data to changes in interest rates or customer behaviour. The guide to monitoring AI for drift covers the signals.
5. Document explainability choices. For each customer-facing model, write down the trade-off between performance and explainability, who made it and what mitigations apply.
6. Report upwards. The DFSA asks firms to consider whether AI risk is significant enough for regular reporting to management and the board.

Where Aicura helps

Aicura is an AI governance platform. Its AI register holds the overview of AI use, including vendor AI, its assessments classify and document each system’s risks, and its oversight, guardrails and monitoring features record where people review decisions and how each system behaves in production. Essentials adds assessment against the EU AI Act, and Pro adds ISO/IEC 42001 and the NIST AI RMF. Aicura does not assess against the DFSA’s paper itself. It supports the work the paper describes, and the judgements stay with your firm.

A note on this guide

This is Aicura’s reading of Finanstilsynet’s good practice paper and the EU AI Act. It is not legal or regulatory advice. Read the primary sources and take advice on how they apply to your firm.